CVE-2024-22024

What it actually does

CVE-2024-22024 is an unauthenticated XML External Entity vulnerability in the SAML processing component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Zero Trust Access gateways. A remote attacker can submit crafted XML to the SAML interface that causes the appliance to process attacker-controlled external entity references. Successful exploitation can allow access to restricted resources without authentication and may expose limited sensitive data or enable unauthorized interaction with protected gateway functionality. The CVSS vector indicates network reachability, low attack complexity, no required privileges or user interaction, and impact across confidentiality, integrity, and availability.

Why it matters to the business

Affected Ivanti gateways are commonly internet-facing remote access and policy enforcement systems, so exploitation can create direct business risk: unauthorized access to protected resources, exposure of sensitive configuration or session-related data, disruption of remote access services, and potential use as an initial foothold into internal networks. Although this CVE is not listed in CISA KEV and is not specifically marked as ransomware-used, the EPSS score is very high and exploit maturity is weaponized, making timely remediation important for any exposed appliance.

How an attack unfolds

An attacker identifies an exposed Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti ZTA gateway and targets the SAML component with specially crafted XML content. The malicious XML attempts to trigger external entity processing by the server-side XML parser. If the appliance is vulnerable, the parser resolves the attacker-controlled entity and the request can bypass normal authentication boundaries or retrieve restricted resources that should not be available to unauthenticated users. The attacker may then use the obtained information or access to enumerate the appliance, probe protected resources, collect configuration or identity-related data, and pivot to additional attacks against the remote access environment.

How to fix it

Upgrade affected Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Zero Trust Access appliances to vendor-supported fixed releases or the latest available maintenance releases from Ivanti. If exact fixed versions are not already tracked internally, consult the Ivanti advisory for CVE-2024-22024 and apply the recommended patch train for 9.x and 22.x deployments. Prioritize internet-facing appliances and any systems with SAML enabled. Where immediate patching is not possible, restrict access to management and authentication interfaces, limit exposure to trusted networks or VPN ingress points, disable unused SAML configurations where operationally feasible, and apply any vendor-provided mitigations or XML parser hardening. After patching, rotate potentially exposed secrets and review SAML identity provider/service provider configuration if compromise is suspected.

How to confirm the fix worked

Confirm the installed Ivanti appliance version and build against Ivanti’s advisory for CVE-2024-22024 and verify it is on a fixed or later release. Validate that all internet-facing and internally exposed Ivanti gateways have been inventoried, including passive, standby, disaster recovery, and lab appliances. Review SAML configuration and confirm only required SAML endpoints are enabled. Use authenticated administrative checks, vulnerability scanners with safe CVE-2024-22024 detection plugins, or vendor integrity tools where available. Confirm that unauthenticated requests to SAML endpoints cannot trigger XML external entity processing and that attempted XML payloads containing DOCTYPE or ENTITY declarations are rejected, logged, or sanitized.

Typical attack path

1. Discover an internet-facing Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti ZTA gateway.
2. Confirm the appliance exposes SAML-related authentication functionality.
3. Send crafted XML/SAML requests designed to trigger external entity processing.
4. Use the XXE behavior to access restricted resources without valid authentication.
5. Harvest exposed information or validate unauthorized access to gateway-protected functionality.
6. Use the access or information obtained to support follow-on intrusion activity, persistence attempts, credential theft, or internal reconnaissance.

How to detect it

Investigate whether the appliance received suspicious SAML/XML requests before remediation. Review Ivanti appliance web access logs, authentication logs, SAML service logs, reverse proxy logs, WAF logs, load balancer logs, EDR/NDR telemetry, DNS logs, and outbound firewall/proxy logs. Look for unauthenticated requests to SAML-related paths containing XML constructs such as DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, jar://, gopher://, ftp://, ldap://, or requests that cause the appliance to initiate unexpected outbound DNS or HTTP connections. Correlate suspicious SAML requests with unusual access to restricted resources, authentication bypass symptoms, new or abnormal sessions, configuration reads, appliance errors from XML parser failures, and outbound callbacks to unfamiliar domains or IP addresses. Because successful XXE exploitation may leave limited artifacts, absence of an obvious payload in access logs does not rule out exploitation; prioritize correlation across web, DNS, firewall, and appliance event sources.

• <!DOCTYPE
• <!ENTITY
• SYSTEM "file://
• SYSTEM 'file://
• PUBLIC "-//
• file:///etc/passwd
• file:///etc/hosts
• file:///proc/self/environ
• file:///proc/net/tcp
• jar://
• gopher://
• ldap://
• ftp://
• expect://
• php://filter
• /dana-na/auth/saml
• /dana-ws/saml
• SAMLRequest=
• SAMLResponse=
• DOCTYPE is disallowed
• External Entity
• external entity
• XXE
• SAXParseException
• DocumentBuilderFactory
• javax.xml.parsers
• org.xml.sax.SAXParseException

What your security team should do

• Treat exposed Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA gateways as high-priority remediation targets because EPSS is very high and exploitation is weaponized.
• Patch or upgrade all affected appliances to Ivanti-supported fixed versions or latest maintenance releases.
• Place emergency change priority on internet-facing systems, SAML-enabled deployments, and appliances protecting sensitive internal applications.
• Run vendor integrity or compromise assessment tooling where available after patching, especially if the appliance was exposed before remediation.
• Review web, SAML, authentication, reverse proxy, and appliance event logs for XXE markers such as DOCTYPE, ENTITY, SYSTEM, file://, and unusual outbound callbacks.
• Restrict inbound access to appliance management and authentication interfaces to the minimum required networks.
• Monitor for unusual outbound HTTP, DNS, LDAP, SMB, or file retrieval attempts from the appliance, which can indicate attempted XXE resolution.
• Rotate credentials, API keys, SAML certificates, session secrets, and other sensitive material if logs or integrity checks suggest exploitation.
• Ensure standby, disaster recovery, and non-production appliances receive the same patch and monitoring coverage as production systems.